They're using bind-params, but instead of using "?" as placeholder, they were using "named" placeholders, and, the placeholder name was constructed using the as

They're using bind-params, but instead of using "?" as placeholder, they were using "named" placeholders, and, the placeholder name was constructed using the associative array key (externally received). The mistake was using a external provided value instead of using "?" or generating independent names for placeholders.